Cons string maps must be marked as unstable.

src/heap.cc

Index: src/heap.cc
diff --git a/src/heap.cc b/src/heap.cc
index aadb83e2a8e274491dfa5322f362f209cfa4719d..3b7a262ec1f11d1665878956bef300965218d77e 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -2586,7 +2586,11 @@ bool Heap::CreateInitialMaps() {
       { MaybeObject* maybe_obj = AllocateMap(entry.type, entry.size);
         if (!maybe_obj->ToObject(&obj)) return false;
       }
-      roots_[entry.index] = Map::cast(obj);
+      // Mark cons string maps as unstable, because their objects can change
+      // maps during GC.
+      Map* map = Map::cast(obj);
+      if (StringShape(entry.type).IsCons()) map->mark_unstable();
+      roots_[entry.index] = map;
     }
 
     ALLOCATE_VARSIZE_MAP(STRING_TYPE, undetectable_string)